CVE-2012-1024: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in file in Enigma2 Webinterface 1.5rc1 and 1.5beta4 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

Code injection

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

CVE-2012-0992

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

CVE-2012-0992: Improper Input Validation

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

CVE-2012-0980

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

CVE-2012-0980: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

Enigma2 'file' Parameter Information Disclosure Vulnerability

Enigma2 is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data. An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks...

Directory traversal

Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter...

CVE-2011-4716

CVE-2011-4716 describes a directory traversal vulnerability in DreamBox DM800 (versions up to 1.6rc3, 1.5rc1 and earlier) that allows remote attackers to read arbitrary files via the file parameter. The affected component is the file handling logic within the DreamBox DM800 firmware. The underlyi...

CVE-2011-4716: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter...

DEBIAN-CVE-2010-4879

PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the inputfile parameter...

CVE-2011-1715

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

CVE-2011-1715: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in framework/source/resource/qx/test/part/delay.php in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to read arbitrary files via ..%2f encoded dot dot sequences in the file parameter...

SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion / Edit

Exploit Title: SQL-Ledger = 2.8.33 Post-authentication Local File Include/Edit Vulnerability Google Dork: inurl:/sql-ledger/login.pl Date: April 15, 2011 Author: bitform Software Link: http://www.sql-ledger.com/source/sql-ledger-2.8.33.tar.gz Version: 2.8.33 Tested on: Ubuntu Server 10.04 CVE :...

CVE-2010-3447

Cross-site scripting XSS vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a viewfile action...

CVE-2010-3447: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a viewfile action...

Format string

Format string vulnerability in authcfg.cgi in Accoria Web Server aka Rock Web Server 1.4.7 allows remote attackers to have an unspecified impact via format string specifiers in the path aka Password File parameter...

CVE-2010-2019

SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2010-2018

Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2010-2019: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...